Windows Server: monitoring file creation

Is there a way either through the API or by a built-in MMC or something to monitor the creation of new files? Tons of space is disappearing from a network share and we can't figure out why from simple examination. Thanks in advance.

Is there a way either through the API or by a built-in MMC or something to monitor the creation of new files? Tons of space is disappearing from a network share and we can't figure out why from simple examination. Thanks in advance.

Monitoring in code or monitoring through some other means?

First make sure you have things set so you can see hidden and system files ... Windows is bad for this, hiding stuff from users.

If you want to do this in code/Windows... look up Change Notices on MSDN... Windows will signal when a directory or file is altered.

Also... (and forgive me if this is too obvious... but a lot of people get tripped up on it)... make sure you limit the sizes of your "garbage cans". Dleted files still occupy space!

Monitoring by any means. I went to lunch today and we had 106 GB free on the server. I came back and we had 79 GB left. We desperately need to know who is moving/copying what.

Right now I set up a trace log for disk input/output under performance monitoring. Going to first try the tracerpt tool to produce a report and when that doesn't tell me anything, I'll probably just write a python script to parse it.

You could also use Process Monitor. Set the filters for disk activity, 'path' to the shared drive and 'operation' to WriteFile and it'll spew out which process is writing to what file, and the offset and size of the write.

The two most useful tools as a network admin are WinDirStat and Process Monitor.

Also, check things like Shadow Copies (which can "consume" space on the drive as time goes by unless you set the options to a fixed size).

- Compiler warnings are like "Bridge Out Ahead" warnings. DON'T just ignore them.
- A compiler error is something SO stupid that the compiler genuinely can't carry on with its job. A compiler warning is the compiler saying "Well, that's bloody stupid but if you WANT to ignore me..." and carrying on.
- The best debugging tool in the world is a bunch of printf()'s for everything important around the bits you think might be wrong.